From 5872780a5a321a9b29d645bc6e82fd8f29e40e9c Mon Sep 17 00:00:00 2001 From: Luca Milanesio Date: Thu, 10 May 2018 17:17:12 +0100 Subject: [PATCH] Fix permissions checks on Gerrit API on current user When the current user is using GerritApi, a new user object with the same user-id of CurrentUser gets created on-the-fly. Even though the user accountId is the same, the user instances are different and will fail all the REST API permissions checks. Turn instance checks with accountId checks to allow user to execute GerritApi on themselves without the requirement of being Gerrit administrators. NOTE: GerritApi are mostly used in plugins, so this change allows other plugins to function properly. Change-Id: Iaeb204dda3791eb2757d89fe6bce6994c6305e04 --- .../java/com/google/gerrit/gpg/server/GpgKeys.java | 2 +- .../java/com/google/gerrit/server/CurrentUser.java | 13 +++++++++++++ .../com/google/gerrit/server/IdentifiedUser.java | 5 +++++ .../com/google/gerrit/server/account/AddSshKey.java | 3 ++- .../google/gerrit/server/account/Capabilities.java | 3 ++- .../google/gerrit/server/account/CreateEmail.java | 3 ++- .../google/gerrit/server/account/DeleteEmail.java | 3 ++- .../gerrit/server/account/DeleteExternalIds.java | 2 +- .../google/gerrit/server/account/DeleteSshKey.java | 3 ++- .../server/account/DeleteWatchedProjects.java | 3 ++- .../gerrit/server/account/GetCapabilities.java | 3 ++- .../gerrit/server/account/GetDiffPreferences.java | 3 ++- .../gerrit/server/account/GetEditPreferences.java | 3 ++- .../gerrit/server/account/GetExternalIds.java | 2 +- .../google/gerrit/server/account/GetOAuthToken.java | 2 +- .../gerrit/server/account/GetPreferences.java | 3 ++- .../google/gerrit/server/account/GetSshKeys.java | 3 ++- .../gerrit/server/account/GetWatchedProjects.java | 3 ++- .../com/google/gerrit/server/account/Index.java | 3 ++- .../gerrit/server/account/PostWatchedProjects.java | 3 ++- .../google/gerrit/server/account/PutAgreement.java | 2 +- .../gerrit/server/account/PutHttpPassword.java | 6 ++++-- .../com/google/gerrit/server/account/PutName.java | 3 ++- .../google/gerrit/server/account/PutPreferred.java | 3 ++- .../com/google/gerrit/server/account/PutStatus.java | 3 ++- .../google/gerrit/server/account/PutUsername.java | 3 ++- .../gerrit/server/account/SetDiffPreferences.java | 3 ++- .../gerrit/server/account/SetEditPreferences.java | 3 ++- .../gerrit/server/account/SetPreferences.java | 3 ++- .../com/google/gerrit/server/account/SshKeys.java | 3 ++- .../gerrit/server/account/StarredChanges.java | 6 +++--- .../com/google/gerrit/server/account/Stars.java | 6 +++--- 32 files changed, 77 insertions(+), 35 deletions(-) diff --git a/gerrit-gpg/src/main/java/com/google/gerrit/gpg/server/GpgKeys.java b/gerrit-gpg/src/main/java/com/google/gerrit/gpg/server/GpgKeys.java index 819ad9641f..9f2acd2464 100644 --- a/gerrit-gpg/src/main/java/com/google/gerrit/gpg/server/GpgKeys.java +++ b/gerrit-gpg/src/main/java/com/google/gerrit/gpg/server/GpgKeys.java @@ -219,7 +219,7 @@ public class GpgKeys implements ChildCollection { if (!BouncyCastleUtil.havePGP()) { throw new ResourceNotFoundException("GPG not enabled"); } - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new ResourceNotFoundException(); } } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/CurrentUser.java b/gerrit-server/src/main/java/com/google/gerrit/server/CurrentUser.java index 029b54d4ae..c6f10d2cc5 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/CurrentUser.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/CurrentUser.java @@ -158,4 +158,17 @@ public abstract class CurrentUser { public ExternalId.Key getLastLoginExternalIdKey() { return get(lastLoginExternalIdPropertyKey); } + + /** + * Checks if the current user has the same account id of another. + * + *

Provide a generic interface for allowing subclasses to define whether two accounts represent + * the same account id. + * + * @param other user to compare + * @return true if the two users have the same account id + */ + public boolean hasSameAccountId(CurrentUser other) { + return false; + } } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/IdentifiedUser.java b/gerrit-server/src/main/java/com/google/gerrit/server/IdentifiedUser.java index 2c4c61ca0e..41b7c67717 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/IdentifiedUser.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/IdentifiedUser.java @@ -498,6 +498,11 @@ public class IdentifiedUser extends CurrentUser { realUser); } + @Override + public boolean hasSameAccountId(CurrentUser other) { + return getAccountId().get() == other.getAccountId().get(); + } + private String guessHost() { String host = null; SocketAddress remotePeer = null; diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/AddSshKey.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/AddSshKey.java index 8c10c737c3..44b632af2e 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/AddSshKey.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/AddSshKey.java @@ -69,7 +69,8 @@ public class AddSshKey implements RestModifyView { @Override public Response apply(AccountResource rsrc, Input input) throws AuthException, BadRequestException, OrmException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("not allowed to add SSH keys"); } return apply(rsrc.getUser(), input); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/Capabilities.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/Capabilities.java index d35656c46d..e53b7d000a 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/Capabilities.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/Capabilities.java @@ -51,7 +51,8 @@ class Capabilities implements ChildCollection throws AuthException, BadRequestException, ResourceConflictException, ResourceNotFoundException, OrmException, EmailException, MethodNotAllowedException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to add email address"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteEmail.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteEmail.java index bcbf794899..79edaa786a 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteEmail.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteEmail.java @@ -60,7 +60,8 @@ public class DeleteEmail implements RestModifyView public Response apply(AccountResource.Email rsrc, Input input) throws AuthException, ResourceNotFoundException, ResourceConflictException, MethodNotAllowedException, OrmException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to delete email address"); } return apply(rsrc.getUser(), rsrc.getEmail()); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteExternalIds.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteExternalIds.java index 42726dcff4..7ab8aaf197 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteExternalIds.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteExternalIds.java @@ -60,7 +60,7 @@ public class DeleteExternalIds implements RestModifyView apply(AccountResource resource, List externalIds) throws RestApiException, IOException, OrmException, ConfigInvalidException { - if (self.get() != resource.getUser()) { + if (!self.get().hasSameAccountId(resource.getUser())) { throw new AuthException("not allowed to delete external IDs"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteSshKey.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteSshKey.java index 3d5d38e6d0..abb01182bc 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteSshKey.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteSshKey.java @@ -50,7 +50,8 @@ public class DeleteSshKey implements RestModifyView apply(AccountResource.SshKey rsrc, Input input) throws AuthException, OrmException, RepositoryNotFoundException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("not allowed to delete SSH keys"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteWatchedProjects.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteWatchedProjects.java index 97102a2428..8cd979f6e4 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteWatchedProjects.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/DeleteWatchedProjects.java @@ -52,7 +52,8 @@ public class DeleteWatchedProjects public Response apply(AccountResource rsrc, List input) throws AuthException, UnprocessableEntityException, OrmException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("It is not allowed to edit project watches of other users"); } if (input == null) { diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetCapabilities.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetCapabilities.java index cd3c0c81f8..fa36d1d43e 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetCapabilities.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetCapabilities.java @@ -78,7 +78,8 @@ class GetCapabilities implements RestReadView { @Override public Object apply(AccountResource resource) throws AuthException { - if (self.get() != resource.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(resource.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("restricted to administrator"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetDiffPreferences.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetDiffPreferences.java index 0edff4f576..c2f7b8f66f 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetDiffPreferences.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetDiffPreferences.java @@ -57,7 +57,8 @@ public class GetDiffPreferences implements RestReadView { @Override public DiffPreferencesInfo apply(AccountResource rsrc) throws AuthException, ConfigInvalidException, IOException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("restricted to administrator"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetEditPreferences.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetEditPreferences.java index e385020182..e795f8322a 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetEditPreferences.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetEditPreferences.java @@ -49,7 +49,8 @@ public class GetEditPreferences implements RestReadView { @Override public EditPreferencesInfo apply(AccountResource rsrc) throws AuthException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("requires Modify Account capability"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetExternalIds.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetExternalIds.java index 6ea911f080..c926cff930 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetExternalIds.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetExternalIds.java @@ -49,7 +49,7 @@ public class GetExternalIds implements RestReadView { @Override public List apply(AccountResource resource) throws RestApiException, OrmException { - if (self.get() != resource.getUser()) { + if (!self.get().hasSameAccountId(resource.getUser())) { throw new AuthException("not allowed to get external IDs"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetOAuthToken.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetOAuthToken.java index 4bbb5d4c9a..61f5b8444e 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetOAuthToken.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetOAuthToken.java @@ -50,7 +50,7 @@ class GetOAuthToken implements RestReadView { @Override public OAuthTokenInfo apply(AccountResource rsrc) throws AuthException, ResourceNotFoundException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed to get access token"); } Account a = rsrc.getUser().getAccount(); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetPreferences.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetPreferences.java index 77cdbd451d..95b115f43d 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetPreferences.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetPreferences.java @@ -36,7 +36,8 @@ public class GetPreferences implements RestReadView { @Override public GeneralPreferencesInfo apply(AccountResource rsrc) throws AuthException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("requires Modify Account capability"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetSshKeys.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetSshKeys.java index 980d880173..a169f6f48c 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetSshKeys.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetSshKeys.java @@ -47,7 +47,8 @@ public class GetSshKeys implements RestReadView { public List apply(AccountResource rsrc) throws AuthException, OrmException, RepositoryNotFoundException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to get SSH keys"); } return apply(rsrc.getUser()); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetWatchedProjects.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetWatchedProjects.java index e0aeee03e0..d8580eb72f 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/GetWatchedProjects.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/GetWatchedProjects.java @@ -51,7 +51,8 @@ public class GetWatchedProjects implements RestReadView { @Override public List apply(AccountResource rsrc) throws OrmException, AuthException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("It is not allowed to list project watches of other users"); } Account.Id accountId = rsrc.getUser().getAccountId(); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/Index.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/Index.java index 1666c708cd..238241c4cc 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/Index.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/Index.java @@ -39,7 +39,8 @@ public class Index implements RestModifyView { @Override public Response apply(AccountResource rsrc, Input input) throws IOException, AuthException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to index account"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PostWatchedProjects.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PostWatchedProjects.java index 55ba912dcc..7a4e0ec7a8 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PostWatchedProjects.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PostWatchedProjects.java @@ -63,7 +63,8 @@ public class PostWatchedProjects @Override public List apply(AccountResource rsrc, List input) throws OrmException, RestApiException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("not allowed to edit project watches"); } Account.Id accountId = rsrc.getUser().getAccountId(); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutAgreement.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutAgreement.java index 423d5a1be5..e622575b3c 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutAgreement.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutAgreement.java @@ -72,7 +72,7 @@ public class PutAgreement implements RestModifyView { String newPassword; if (input.generate) { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("not allowed to generate HTTP password"); } newPassword = generate(); } else if (input.httpPassword == null) { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("not allowed to clear HTTP password"); } newPassword = null; diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutName.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutName.java index 443a549729..a00e2ad1b6 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutName.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutName.java @@ -61,7 +61,8 @@ public class PutName implements RestModifyView { public Response apply(AccountResource rsrc, Input input) throws AuthException, MethodNotAllowedException, ResourceNotFoundException, OrmException, IOException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to change name"); } return apply(rsrc.getUser(), input); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutPreferred.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutPreferred.java index ec60fb31de..d86a312bb4 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutPreferred.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutPreferred.java @@ -50,7 +50,8 @@ public class PutPreferred implements RestModifyView apply(AccountResource.Email rsrc, Input input) throws AuthException, ResourceNotFoundException, OrmException, IOException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to set preferred email address"); } return apply(rsrc.getUser(), rsrc.getEmail()); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutStatus.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutStatus.java index ff541fdae4..c16d8da0f9 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutStatus.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutStatus.java @@ -58,7 +58,8 @@ public class PutStatus implements RestModifyView { @Override public Response apply(AccountResource rsrc, Input input) throws AuthException, ResourceNotFoundException, OrmException, IOException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canModifyAccount()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canModifyAccount()) { throw new AuthException("not allowed to set status"); } return apply(rsrc.getUser(), input); diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutUsername.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutUsername.java index e3a3c12adf..21b17205a7 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/PutUsername.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/PutUsername.java @@ -59,7 +59,8 @@ public class PutUsername implements RestModifyView { public String apply(AccountResource rsrc, Input input) throws AuthException, MethodNotAllowedException, UnprocessableEntityException, ResourceConflictException, OrmException, IOException, ConfigInvalidException { - if (self.get() != rsrc.getUser() && !self.get().getCapabilities().canAdministrateServer()) { + if (!self.get().hasSameAccountId(rsrc.getUser()) + && !self.get().getCapabilities().canAdministrateServer()) { throw new AuthException("not allowed to set username"); } diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/SetDiffPreferences.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/SetDiffPreferences.java index ac0cc963fb..c72ff0241e 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/SetDiffPreferences.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/SetDiffPreferences.java @@ -59,7 +59,8 @@ public class SetDiffPreferences implements RestModifyView apply(AccountResource rsrc, EmptyInput in) throws AuthException, OrmException, IOException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed to add starred change"); } try { @@ -159,7 +159,7 @@ public class StarredChanges @Override public Response apply(AccountResource.StarredChange rsrc, EmptyInput in) throws AuthException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed update starred changes"); } return Response.none(); @@ -180,7 +180,7 @@ public class StarredChanges @Override public Response apply(AccountResource.StarredChange rsrc, EmptyInput in) throws AuthException, OrmException, IOException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed remove starred change"); } starredChangesUtil.star( diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/account/Stars.java b/gerrit-server/src/main/java/com/google/gerrit/server/account/Stars.java index 52c6cdfa9f..cf43a21c64 100644 --- a/gerrit-server/src/main/java/com/google/gerrit/server/account/Stars.java +++ b/gerrit-server/src/main/java/com/google/gerrit/server/account/Stars.java @@ -97,7 +97,7 @@ public class Stars implements ChildCollection apply(AccountResource rsrc) throws BadRequestException, AuthException, OrmException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed to list stars of another account"); } QueryChanges query = changes.list(); @@ -119,7 +119,7 @@ public class Stars implements ChildCollection apply(AccountResource.Star rsrc) throws AuthException, OrmException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed to get stars of another account"); } return starredChangesUtil.getLabels(self.get().getAccountId(), rsrc.getChange().getId()); @@ -140,7 +140,7 @@ public class Stars implements ChildCollection apply(AccountResource.Star rsrc, StarsInput in) throws AuthException, BadRequestException, OrmException { - if (self.get() != rsrc.getUser()) { + if (!self.get().hasSameAccountId(rsrc.getUser())) { throw new AuthException("not allowed to update stars of another account"); } try {